Deep Malware Analysis of e35bf4bd8ed78626b63cb917fb2fd576 | md5: e35bf4bd8ed78626b63cb917fb2fd576 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.83

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	e35bf4bd8ed78626b63cb917fb2fd576
Sha1	de348334e29485376b4e0f5487faf00184c51349
Sha256	4c3c4e06e9994eded388727f5744c0746b76cb66f49efc0113111c7e6f975802
Sha384	af41c63a50daf9393e4ba0f12fb63859f7324ada9d91e005b319ace6f28ca0df5584ead67bd74299008897ebf331f7c4
Sha512	24e0f5358f18bed99b96558c85a14881c2076972b645f26f3e9e5a7d43f8aeb21d093a64597a9b0bb6aa45b48cb8c6552e0e7e351962a359d789f2daedcd9064
SSDeep	24576:/klFxzjP/2oSdv/ynygaK1aQmzFtPdYfTWcv4u2QXMixvMFky4Eip:SNb/2oSQnyzDzFtPdqTWcAuNZxvMGy
TLSH	A145AD583211EC9EC4928971C9E0DDFAA6302CA7D616E20395E73D9FB93D586EF101E3

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	QnIy.exe
Full Name	QnIy.exe
EntryPoint	System.Void HydroReservoir.Program::Main()
Scope Name	QnIy.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	QnIy
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	395
Main Method	System.Void HydroReservoir.Program::Main()
Main IL Instruction Count	55
Main IL	nop <null> ldc.i4 -154653753 ldc.i4 -709968010 xor <null> dup <null> stloc.0 <null> ldc.i4.8 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_00B2: ret ldc.i4.0 <null> call System.Void HydroReservoir.Program::‎‍⁪‭⁫‪‍⁮‏‏⁮‌‭‍⁭‮‬⁫‎‮⁮‭‪‭‮‮‫‬‬‏⁮‮⁬‎⁫⁭⁮‮(System.Boolean) ldloc.0 <null> ldc.i4 -1889846562 mul <null> ldc.i4 445264121 xor <null> br.s IL_0006: ldc.i4 -709968010 nop <null> ldloc.0 <null> ldc.i4 382636720 mul <null> ldc.i4 -1006345878 xor <null> br.s IL_0006: ldc.i4 -709968010 call System.Void HydroReservoir.Program::⁭‬‭‪‎‏⁪⁯‍‌⁬⁫‮⁭⁭‮⁬‭‎‬‍‬⁯‏‍‪⁭‭‬‪‭⁪⁬⁯⁮‌‮() ldloc.0 <null> ldc.i4 -1347511583 mul <null> ldc.i4 448557284 xor <null> br.s IL_0006: ldc.i4 -709968010 newobj System.Void HydroReservoir.ParentForm::.ctor() call System.Void HydroReservoir.Program::⁫‭⁯⁮‮‎⁪‪‎‌‎⁪⁮⁭‌⁯‏⁯‏⁫‮‭⁮⁪‬‏⁯⁬⁭‭⁮⁯‬‭⁭⁯‮(System.Windows.Forms.Form) ldloc.0 <null> ldc.i4 -455482015 mul <null> ldc.i4 1414402004 xor <null> br IL_0006: ldc.i4 -709968010 nop <null> ldloc.0 <null> ldc.i4 -1510982888 mul <null> ldc.i4 -1939777240 xor <null> br IL_0006: ldc.i4 -709968010 nop <null> ldloc.0 <null> ldc.i4 1086765315 mul <null> ldc.i4 172024563 xor <null> br IL_0006: ldc.i4 -709968010 ret <null>
Module Name	QnIy.exe
Full Name	QnIy.exe
EntryPoint	System.Void HydroReservoir.Program::Main()
Scope Name	QnIy.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	QnIy
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	395
Main Method	System.Void HydroReservoir.Program::Main()
Main IL Instruction Count	55
Main IL	nop <null> ldc.i4 -154653753 ldc.i4 -709968010 xor <null> dup <null> stloc.0 <null> ldc.i4.8 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_00B2: ret ldc.i4.0 <null> call System.Void HydroReservoir.Program::‎‍⁪‭⁫‪‍⁮‏‏⁮‌‭‍⁭‮‬⁫‎‮⁮‭‪‭‮‮‫‬‬‏⁮‮⁬‎⁫⁭⁮‮(System.Boolean) ldloc.0 <null> ldc.i4 -1889846562 mul <null> ldc.i4 445264121 xor <null> br.s IL_0006: ldc.i4 -709968010 nop <null> ldloc.0 <null> ldc.i4 382636720 mul <null> ldc.i4 -1006345878 xor <null> br.s IL_0006: ldc.i4 -709968010 call System.Void HydroReservoir.Program::⁭‬‭‪‎‏⁪⁯‍‌⁬⁫‮⁭⁭‮⁬‭‎‬‍‬⁯‏‍‪⁭‭‬‪‭⁪⁬⁯⁮‌‮() ldloc.0 <null> ldc.i4 -1347511583 mul <null> ldc.i4 448557284 xor <null> br.s IL_0006: ldc.i4 -709968010 newobj System.Void HydroReservoir.ParentForm::.ctor() call System.Void HydroReservoir.Program::⁫‭⁯⁮‮‎⁪‪‎‌‎⁪⁮⁭‌⁯‏⁯‏⁫‮‭⁮⁪‬‏⁯⁬⁭‭⁮⁯‬‭⁭⁯‮(System.Windows.Forms.Form) ldloc.0 <null> ldc.i4 -455482015 mul <null> ldc.i4 1414402004 xor <null> br IL_0006: ldc.i4 -709968010 nop <null> ldloc.0 <null> ldc.i4 -1510982888 mul <null> ldc.i4 -1939777240 xor <null> br IL_0006: ldc.i4 -709968010 nop <null> ldloc.0 <null> ldc.i4 1086765315 mul <null> ldc.i4 172024563 xor <null> br IL_0006: ldc.i4 -709968010 ret <null>